[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities
On Mar 27, 2:09pm, cxib@xxxxxxxxxxxxxxxxxx (cxib@xxxxxxxxxxxxxxxxxx) wrote:
-- Subject: [securityreason] *BSD libc (strfmon) Multiple vulnerabilities
[... stuff deleted ...]
| Problem exist also in printf() function.
| Example code will show Integer Overflow .
| - ---example-start--
| #include <stdio.h>
| main(int argc, char *argv)
| printf("%1410065408.1410065407f\n", 2);
| return 0;
| - ---example-end--
| cxib# gcc -o pln pln.c && ./pln
| Segmentation fault (core dumped)
| What is wrong? the same problem that was in strfmon() function.
This is not the same problem, as I pointed out when I found it
after I fixed the integer overflow in strfmon(3). This is a NULL
pointer dereference caused by an unchecked memory allocation failure
in the gdtoa code. You don't even need to compile any code to cause
$ printf %9999999999.999999999g 2